Part of our site, say https://www.example.com/files, is protected by mod_auth_mellon, which provides an SP that authenticates with our IdP. This works fine.
The rest of the site is Drupal with the samplesamlphp_auth module. That module creates another SP that authenticates with the same IdP. This also works fine.
The problem is that the login isn't shared between these two SPs. You have to log in separately to each one, even though the user is authenticating to the same IdP. Obviously that's not desirable. When I log into one, I want the other to detect and use the SAML session data to log me in too.
Is that a reasonable thing to expect? I was thinking that two different SPs on the same host would share session information automatically, but now I think that's not how it works. Each SP stores session information in cookies in the user agent. The cookies have different names, but more importantly they refer to sessions from the different SPs. So they can't be shared.
This thread has some discussion of the problem. Based on that, what I think is needed is for the IdP to recognize the state information it saved in the user agent, and not ask the user to log in again. Is that right? How can I frame this problem for the IdP admins?